The Fine
Google has been fined €403 million ($463 million) by Ireland's Data Protection Commission (DPC) for breaching the EU's General Data Protection Regulation (GDPR) through how it handled users' location data. The DPC announced the penalty Monday, capping an investigation that first opened six years ago.
Ireland is Google's lead EU regulator because the company's European headquarters sits in Dublin — under GDPR's "one-stop-shop" mechanism, the DPC in a company's home member state takes point on cross-border enforcement actions.
What Investigators Found
The DPC's investigation concluded Google failed to process location data lawfully, fairly, or transparently across three separate surfaces:
- Web & App Activity — the Google account setting that logs browsing and search history
- Location History — the service that maps the places a user's phone has physically been
- Location Accuracy — an Android OS feature that improves positioning precision using additional signals
In each case, regulators found the legal basis and transparency around how that data was collected and processed did not meet GDPR's requirements.
Where This Ranks
At €403 million, this is the fourth-largest privacy fine the Irish DPC has ever issued. It trails the regulator's biggest actions against Meta, including a €1.2 billion fine — still the largest GDPR penalty on record. The DPC has now built a track record of issuing nine- and ten-figure fines against the largest US tech platforms operating in the EU.
Notably, this isn't Google's only open matter with the Irish regulator: the DPC says it has three additional investigations into Google still ongoing, meaning further enforcement action is possible.
Why This Matters
A six-year investigation resulting in a $463 million fine underscores how methodically EU regulators are willing to work through complex cross-border cases against the largest tech companies — and how location data specifically remains one of the most heavily scrutinized categories under GDPR, given its sensitivity and the ease with which it can be used to infer a person's habits, relationships, and daily movements. For any organization processing location signals from EU users — not just Google-scale platforms — this fine is a reminder that lawful basis and transparency obligations apply with equal weight regardless of company size, and that DPC investigations can span years before resulting in enforcement.